@atbas/m-mcp 0.1.0

package/dist/domain/signature/scheme.d.ts

@@ -0,0 +1,349 @@
+import { type DocRef } from '../../errors.js';
+import { type NormalisedParameters, type RawParameters } from '../types.js';
+/**
+ * The vocabulary a request signature is described in, and the engine that
+ * executes one.
+ *
+ * No two gateways sign the same way. JazzCash sorts the payload by field name,
+ * joins the non-empty values with `&`, prepends the Integrity Salt and HMACs
+ * the result.
+ *
+ * That is expressed here as a `SignaturePlan`: a recipe explicit enough that
+ * adding a gateway is a new plan rather than a new branch inside this file. The
+ * alternative — a second engine, or a second set of `if` statements — produces
+ * the failure this module exists to prevent. A forensic table written for one
+ * construction, replayed against a payload signed under another, reports that
+ * payload's CORRECT construction as a proven defect: several entries in the
+ * JazzCash table (a plain digest, the salt at the far end, empty components
+ * kept) are how other gateways legitimately sign.
+ */
+/** Every signature construction the server can produce and diagnose. */
+export declare const SIGNATURE_SCHEME_IDS: readonly ["jazzcash"];
+export type SignatureSchemeId = (typeof SIGNATURE_SCHEME_IDS)[number];
+/**
+ * Digest encoding.
+ *
+ * The member names are the ones `hash.outputEncoding` uses in the flow schema,
+ * so a catalogue value reaches the engine untranslated. A mapping table between
+ * the two vocabularies would be one more place for them to drift apart, and a
+ * drift there is a wrong signature rather than a type error.
+ */
+export type SignatureEncoding = 'hex-lowercase' | 'base64';
+/**
+ * How a supplied signature is compared with the computed one.
+ *
+ * `case-insensitive` is required for JazzCash, whose guides print the same
+ * digest lowercase in requests and uppercase in responses. It is wrong for
+ * base64, where case carries information: folding it maps distinct digests onto
+ * one string, so a signature nobody could have computed would verify.
+ */
+export type SignatureComparison = 'case-insensitive' | 'case-sensitive';
+/** The order the selected values are joined in. */
+type FieldOrdering = 'name-ascending' | 'name-descending' | 'name-ascending-folded' | 'as-listed';
+/** Where the shared secret sits in the signed string, if it appears at all. */
+type SecretPlacement = 'prepend' | 'append' | 'none';
+/** Keyed HMAC, or a plain digest of a string the secret is part of. */
+type SignaturePrimitive = 'hmac' | 'digest';
+type DigestAlgorithm = 'sha256' | 'sha512';
+/** Whether the field name travels with its value into the signed string. */
+type ValuePairing = 'values-only' | 'name-and-value';
+/** Whether values are signed exactly as transmitted. */
+type ValueTransform = 'as-transmitted' | 'trimmed';
+/** Prefix-matched field selection. */
+interface PrefixFieldSelection {
+    readonly kind: 'prefix';
+    /** Only fields starting with one of these participate. Empty means no filter. */
+    readonly includeFieldPrefixes: readonly string[];
+    readonly excludeFields: readonly string[];
+}
+/**
+ * Which parameters contribute to the signature.
+ *
+ * A named union of one, rather than `PrefixFieldSelection` used directly: the
+ * `kind` discriminator is what a second selection rule would be added to, and
+ * every consumer already reads it. A gateway that fixes its components by
+ * position rather than by prefix cannot be expressed by widening this one — it
+ * needs its own member here and its own branch in `selectFields`.
+ */
+type FieldSelection = PrefixFieldSelection;
+/**
+ * A fully resolved recipe for turning a payload into a signature.
+ *
+ * Every member is stated even where two schemes agree, so that reading one plan
+ * tells you the whole construction. A knob left implicit is a knob a second
+ * provider silently inherits.
+ */
+export interface SignaturePlan {
+    readonly selection: FieldSelection;
+    readonly ordering: FieldOrdering;
+    readonly pairing: ValuePairing;
+    readonly valueTransform: ValueTransform;
+    /** Drop a value that is empty after `valueTransform`. */
+    readonly omitEmptyValues: boolean;
+    /** Count a whitespace-only value as empty. */
+    readonly treatWhitespaceOnlyAsEmpty: boolean;
+    /** Placed between values, and between the secret and the values. May be empty. */
+    readonly separator: string;
+    /** Leave a separator on the end, as an append-in-a-loop implementation does. */
+    readonly trailingSeparator: boolean;
+    readonly secretPlacement: SecretPlacement;
+    readonly primitive: SignaturePrimitive;
+    readonly digest: DigestAlgorithm;
+    readonly encoding: SignatureEncoding;
+    readonly comparison: SignatureComparison;
+}
+export type ExclusionReason = 'empty' | 'excluded-field' | 'prefix-not-matched';
+export interface ExcludedSignatureField {
+    readonly name: string;
+    readonly reason: ExclusionReason;
+}
+export interface SignatureBreakdown {
+    /** Parameter names that contributed, in the order their values were joined. */
+    readonly includedFields: readonly string[];
+    /** Parameter names that did not contribute, each with the reason. */
+    readonly excludedFields: readonly ExcludedSignatureField[];
+    /**
+     * The exact string that is digested. Contains the shared secret.
+     *
+     * Named for what it is rather than for the scheme: every consumer — the
+     * builder, the hash tools, the diagnosis output — shows this string to a
+     * merchant comparing it with their own code by eye.
+     */
+    readonly hashString: string;
+    /** The values, in signing order, without the secret. */
+    readonly values: readonly string[];
+}
+export interface SignatureVerification {
+    readonly matches: boolean;
+    /** The signature this implementation computed. */
+    readonly expectedHash: string;
+    /** The signature supplied by the caller, normalised for comparison. */
+    readonly providedHash: string;
+    readonly breakdown: SignatureBreakdown;
+}
+/** What a provider calls its shared secret, and why a blank one cannot work. */
+export interface SecretDescription {
+    /** The provider's own name for it, e.g. `Integrity Salt`. */
+    readonly label: string;
+    /** How it is used, phrased so the merchant can check the value they hold. */
+    readonly role: string;
+    readonly docRefs: readonly DocRef[];
+}
+/**
+ * The sentences a diagnosis is reported in.
+ *
+ * Provider-specific because the words are: a merchant told their "salt" is
+ * wrong when their provider issues an "API password" will check the wrong
+ * credential, and a diagnosis nobody can act on is worse than none.
+ */
+export interface SignatureNarrative {
+    /** Used when the supplied signature is already correct. */
+    readonly matched: string;
+    /** Used with the confirmed labels appended after a colon. */
+    readonly reproducedPrefix: string;
+    /** Used when no variant in the table reproduces the supplied signature. */
+    readonly unexplained: string;
+}
+/** Advice offered when nothing in the table reproduces the merchant's signature. */
+export interface SignatureAdvice {
+    readonly id: string;
+    readonly label: string;
+    readonly explanation: string;
+    readonly fix: string;
+}
+/**
+ * One change to a plan, expressed as data rather than as a function.
+ *
+ * A closed set of single-field edits is what makes a forensic table safe to run
+ * at all. A free `(plan) => plan` callback can return ANY plan, including
+ * another provider's correct construction, and the type system has nothing to
+ * say about it: a table entry returning another gateway's plan compiled cleanly
+ * and reported that gateway's CORRECT signature as a proven defect. A delta
+ * cannot build a plan. It can only name one field of the plan it is applied to,
+ * so a variant is always its own scheme's construction with exactly one thing
+ * wrong.
+ *
+ * A delta naming a field the plan's selection does not have leaves the plan
+ * unchanged. That is harmless rather than silent: an unchanged plan computes the
+ * CORRECT signature, and `diagnoseSignature` runs the table only after the
+ * correct signature has already failed to match, so such a variant can never be
+ * reported.
+ */
+type PlanDelta = {
+    readonly set: 'ordering';
+    readonly to: FieldOrdering;
+} | {
+    readonly set: 'pairing';
+    readonly to: ValuePairing;
+} | {
+    readonly set: 'valueTransform';
+    readonly to: ValueTransform;
+} | {
+    readonly set: 'omitEmptyValues';
+    readonly to: boolean;
+} | {
+    readonly set: 'separator';
+    readonly to: string;
+} | {
+    readonly set: 'trailingSeparator';
+    readonly to: boolean;
+} | {
+    readonly set: 'secretPlacement';
+    readonly to: SecretPlacement;
+} | {
+    readonly set: 'primitive';
+    readonly to: SignaturePrimitive;
+} | {
+    readonly set: 'digest';
+    readonly to: DigestAlgorithm;
+} | {
+    readonly set: 'encoding';
+    readonly to: SignatureEncoding;
+} | {
+    readonly set: 'excludeFields';
+    readonly to: readonly string[];
+} | {
+    readonly set: 'includeFieldPrefixes';
+    readonly to: readonly string[];
+};
+/**
+ * A wrong-but-plausible construction, stated as one change to a scheme's own plan.
+ *
+ * What is enforced is that `change` is a single field edit applied by the engine
+ * to the plan the scheme resolved from the merchant's own settings. A definition
+ * cannot construct a plan, so it cannot name another provider's construction —
+ * see `PlanDelta`. What is NOT enforced is the wording: a table bound to the
+ * wrong scheme would describe a real near miss in the wrong provider's
+ * vocabulary, which `tests/domain/signature.test.ts` pins per scheme.
+ */
+export interface SignatureVariantDefinition {
+    readonly id: string;
+    readonly label: string;
+    readonly explanation: string;
+    readonly fix: string;
+    /** The single plan field this mistake changes, and what it becomes. */
+    readonly change: PlanDelta;
+}
+/** A variant bound to a scheme, executable against a merchant's own payload. */
+export interface SignatureVariant<TSettings> {
+    readonly id: string;
+    readonly label: string;
+    readonly explanation: string;
+    readonly fix: string;
+    compute(parameters: NormalisedParameters, secret: string, settings: TSettings): string;
+}
+/**
+ * One provider's signature construction, with the forensics that belong to it.
+ *
+ * `TSettings` is the per-flow configuration the scheme accepts — field prefixes
+ * and exclusions for JazzCash. It is a type parameter rather than a shared bag
+ * of optional fields so that a scheme cannot be handed another scheme's
+ * configuration and quietly sign with half of each.
+ */
+export interface SignatureScheme<TSettings> {
+    readonly id: SignatureSchemeId;
+    /** Human-readable name, e.g. `JazzCash pp_SecureHash`. */
+    readonly label: string;
+    readonly secret: SecretDescription;
+    readonly narrative: SignatureNarrative;
+    /** The provider's documented construction, resolved against flow settings. */
+    plan(settings: TSettings): SignaturePlan;
+    /**
+     * The resolved construction in one sentence, for a merchant to implement.
+     *
+     * A member of the scheme rather than a free function so that a provider whose
+     * construction cannot be described in the shared vocabulary has somewhere to
+     * say so. Both registered schemes delegate to `describeConstruction`, because
+     * a sentence written by hand describes the construction its author had in mind
+     * while the engine executes the one the flow configured, and the merchant
+     * implements the sentence.
+     */
+    describePlan(plan: SignaturePlan): string;
+    /** Wrong-but-plausible constructions for THIS scheme, and only this scheme. */
+    readonly variants: readonly SignatureVariant<TSettings>[];
+    /** Ranked advice for when no variant reproduces the supplied signature. */
+    readonly advice: readonly SignatureAdvice[];
+}
+/**
+ * Whether the construction a diagnosis runs under is the one the payload was
+ * signed with, or one this server chose on the payload's behalf.
+ *
+ * `confirmed` means a variant reproduced the merchant's signature, which is
+ * evidence only if the construction it varies is the construction they used.
+ * Where the construction was assumed, the same reproduction is just as likely to
+ * BE the merchant's correct construction under a provider this server has never
+ * been told about — which is how a correct `SHA256(secret&sorted-values)`
+ * signature came to be reported as "Plain SHA-256 used instead of HMAC-SHA256",
+ * with maximum confidence, to a merchant whose code was right.
+ */
+export type SchemeProvenance = 'declared' | 'assumed';
+export interface SignatureHypothesis {
+    readonly id: string;
+    readonly label: string;
+    readonly explanation: string;
+    readonly fix: string;
+    /** `confirmed` means this variant reproduces the merchant's signature exactly. */
+    readonly confidence: 'confirmed' | 'possible';
+}
+export interface SignatureDiagnosis {
+    readonly matches: boolean;
+    readonly expectedHash: string;
+    readonly providedHash: string;
+    readonly breakdown: SignatureBreakdown;
+    /** Confirmed causes first, then remaining candidates worth checking. */
+    readonly hypotheses: readonly SignatureHypothesis[];
+    readonly summary: string;
+}
+/** Constant-time signature comparison under a scheme's own case rule. */
+export declare function signaturesMatch(left: string, right: string, comparison: SignatureComparison): boolean;
+/**
+ * One sentence describing exactly how a plan builds the string it digests.
+ *
+ * Derived from the plan rather than written out per scheme, because a sentence
+ * written by hand describes the construction its author had in mind while the
+ * engine executes the one the flow configured — and a merchant implements the
+ * sentence, not the code. The two drift silently: nothing fails when a flow is
+ * described by a paragraph belonging to a different construction.
+ */
+export declare function describeConstruction(plan: SignaturePlan, secretLabel: string): string;
+/**
+ * One sentence naming the digest encoding and the comparison rule.
+ *
+ * Read from the plan for the same reason as the construction: a flow declaring
+ * base64 and case-sensitive comparison was told its output was lowercase hex
+ * compared case-insensitively, which is the advice that makes a correct
+ * signature look broken.
+ */
+export declare function describeEncoding(plan: SignaturePlan): string;
+/**
+ * Bind a table of plan deltas to a scheme.
+ *
+ * Each variant re-resolves the scheme's plan from the merchant's own settings
+ * before applying its delta, so a flow that narrows the field selection is
+ * diagnosed against ITS construction rather than against the scheme default.
+ */
+export declare function defineVariants<TSettings>(plan: (settings: TSettings) => SignaturePlan, definitions: readonly SignatureVariantDefinition[]): readonly SignatureVariant<TSettings>[];
+/** Build the signed string for a payload under one scheme. */
+export declare function buildSignature<TSettings>(scheme: SignatureScheme<TSettings>, parameters: RawParameters, secret: string, settings: TSettings): SignatureBreakdown;
+/** Compute the signature for a payload under one scheme. */
+export declare function computeSignature<TSettings>(scheme: SignatureScheme<TSettings>, parameters: RawParameters, secret: string, settings: TSettings): string;
+/** Verify a supplied signature against a freshly computed one. */
+export declare function verifySignature<TSettings>(scheme: SignatureScheme<TSettings>, parameters: RawParameters, secret: string, providedSignature: string, settings: TSettings): SignatureVerification;
+/**
+ * Explain why a signature does not match, using one scheme's forensics only.
+ *
+ * Every variant of the scheme is executed against the merchant's own parameters.
+ * One that reproduces the signature they actually sent is reported as
+ * `confirmed`: that is not a guess, it is a demonstration of what their code
+ * did — provided the construction being varied is the one the payload was signed
+ * under. `provenance` is what says whether it is; see `SchemeProvenance`. Under
+ * an assumed construction no variant runs at all, and the scheme's ranked advice
+ * is offered as `possible` instead.
+ *
+ * A variant can only ever be its own scheme's plan with one field changed, which
+ * is what stops the table offering another provider's correct construction as a
+ * defect; see `PlanDelta`.
+ */
+export declare function diagnoseSignature<TSettings>(scheme: SignatureScheme<TSettings>, parameters: RawParameters, secret: string, providedSignature: string, settings: TSettings, provenance: SchemeProvenance): SignatureDiagnosis;
+export {};
+//# sourceMappingURL=scheme.d.ts.map

package/dist/domain/signature/scheme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheme.d.ts","sourceRoot":"","sources":["../../../src/domain/signature/scheme.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAA8C,KAAK,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAExH;;;;;;;;;;;;;;;;GAgBG;AAEH,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,uBAAwB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,QAAQ,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAExE,mDAAmD;AACnD,KAAK,aAAa,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,WAAW,CAAC;AAElG,+EAA+E;AAC/E,KAAK,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErD,uEAAuE;AACvE,KAAK,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE5C,KAAK,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3C,4EAA4E;AAC5E,KAAK,YAAY,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAErD,wDAAwD;AACxD,KAAK,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAEnD,sCAAsC;AACtC,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,KAAK,cAAc,GAAG,oBAAoB,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,yDAAyD;IACzD,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAEhF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAQD,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC3D;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;CACxC;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,SAAS,GACV;IAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,kBAAkB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,GAAG,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAsC7E;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB,CAAC,SAAS;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,UAAU,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,MAAM,CAAC;CACxF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,SAAS;IACxC,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,8EAA8E;IAC9E,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC;IACzC;;;;;;;;;OASG;IACH,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1D,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,WAAW,GAAG,UAAU,CAAC;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAyJD,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAOrG;AAuCD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAyBrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAK5D;AAyBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EACtC,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,aAAa,EAC5C,WAAW,EAAE,SAAS,0BAA0B,EAAE,GACjD,SAAS,gBAAgB,CAAC,SAAS,CAAC,EAAE,CASxC;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,SAAS,EACtC,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,EAClC,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,GAClB,kBAAkB,CAGpB;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,SAAS,EACxC,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,EAClC,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,GAClB,MAAM,CAGR;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,SAAS,EACvC,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,EAClC,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,SAAS,GAClB,qBAAqB,CAavB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EACzC,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,EAClC,UAAU,EAAE,aAAa,EACzB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,SAAS,EACnB,UAAU,EAAE,gBAAgB,GAC3B,kBAAkB,CAkDpB"}